EUVD-2026-54423
GHSA-63m9-m4r7-4qjg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-delivered crafted payload requires no authentication or interaction; impact is strictly availability via process crash, with no confidentiality or integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.
This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
AnalysisAI
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected services by sending crafted serialized data containing malformed type metadata, triggering an uncaught Go runtime panic. Affected versions span 0.16.0 through 1.5.0 (exclusive), while all non-Go language implementations remain unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target service is built using the Go implementation of Apache Fory (versions 0.16.0-1.4.x) and that it deserializes data supplied or influenced by an attacker - such as data received over a network API, a message broker, or any other externally accessible channel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5, reflecting straightforward network-reachable exploitation with no prerequisites - technically accurate for a network-facing Go service consuming untrusted Fory-serialized data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a network-accessible service built with the Apache Fory Go library that accepts and deserializes user-supplied data - for example, an RPC endpoint or message queue consumer. The attacker crafts a binary payload that conforms to Fory's wire format but contains structurally invalid type metadata, then submits it to the endpoint. … |
| Remediation | The primary fix is to upgrade to Apache Fory 1.5.0, which resolves the uncaught panic by adding defensive validation of type metadata during deserialization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Apache Fory Go implementations running affected versions (0.16.0-1.5.0) in your infrastructure using asset discovery or container registry scans. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserializat
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today